My question is: does a stealth port imply a closed port ? (I'm betting not, I always thought it was simply something to stop port scanning ... something which however fails at this)

If I understand correctly, a stealth port does not necessarily imply a closed port. My understanding:

A stealth port does not respond to any query. A closed port responds (Yes! I'm here!) but only allows traffic that is initiated or allowed from the host. For example, a closed SSH port will respond and allow traffic only by using the appropriate password or key (the correct password or key basically initiates traffic from the inside). A stealth SSH port will not respond to any query and the outside user must know the port number to get through.

I'd be grateful for clarification too.

Hi,

Not a real good indicator but does give you a fair test. There are ways to get into the system but I will not expose as per the LQ rules. A user can search on the Internet an get enough information to do a lot of harm.

Explanation:

Hmm, I see. So if a port is stealth it will simply drop all incoming packets and not respond to any probes. I guess so will a closed port, but the difference is that a closed port will respond to probes saying that it is closed. Right ?

Yes, basically you're right. But stealth being overrated [1] [2] [3] I would really love to see this discussion adopt a broader view of things again. There's some snippets already:

# single point of failure: not relying on one level of measures.

# awareness: security being a continuous effort not single shot.

# knowledge: knowing how to properly and responsably operate a system.


In the end IMHO a lot of problems are not with software but wetware. Most of systems hardening and auditing is just following the rulebook, using common sense, reiteration. While "cyber crimes" as the OP said, "cyber theft" or whatever you want to call it is part susceptibility of software it more importantly is that of users. Education will combat ignorance but even if we have phishing checks and whatnot, no software will fix stupidity.

Yup, that's definitely true.

Hi,

It's not just stupidity. Social engineering gets a lot of people to expose themselves to identity theft via the web, mail or personal contact. Trust has been a way for a thief to get what people have via deception. You need to keep the honest people honest. But the thief will always try to get what you have so one must stay one step ahead of that type. The malware problem shows us how a lot of people fall into this type of trap.

Yes, you can fall into the security blanket trap with one size fits all. You must stay abreast with all the necessary tools to allow the system(s) to service the needs. Call it wetware but I call it common sense. Not enough common sense is being used today to rid us of the problem.

Stealth ports are also better for another reason. Certain network attacks can use your system to generate traffic to a victim if your system is responding to incoming data, even if that response is a denial. a prime example is a Smurf attack. Your system doesn't even need to be compromised to be used in a smurf attack. (one example, there are variations of this.)

If your box where completely stealthed and dropping those invalid incoming packets and not responding to them or to pings your system could not be used in that type or a variation of this type of attack.

I typically set my firewall rules to 'Drop' rather than to 'Deny' when possible for that reason. Also a Deny, give an immediate response, where, with a drop the attacker / scanner has to wait to timeout for lack of a response, making his scan slower.

smurf attack, never knew smurfs were dangerous, they always looked harmless to me